NetScaler and Apple Zero-Days Hit KEV as Astrana, Hasbro Disclose Breaches

CISA's Known Exploited Vulnerabilities catalog grew this week with a Citrix NetScaler remote-code-execution flaw now facing mass exploitation and an Apple Core Graphics zero-day used in a targeted attack. Meanwhile, Astrana Health and Hasbro disclosed social-engineering breaches, the FBI's job-application portals remained offline after a ShinyHunters claim, and Lumen named a new Chief Security Officer.

CISA adds actively exploited Citrix NetScaler flaws to KEV Catalog

CISA added two Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities Catalog after amplifying Citrix's disclosure of eight flaws in NetScaler ADC and Gateway. Both added bugs are critical zero-days that independently enable remote code execution, and CISA said partner threat intelligence confirms threat actors are exploiting them globally. The agency urged organizations to review Citrix's advisories, check for signs of compromise before patching, and preserve forensic evidence, since applying updates can erase evidence of an existing intrusion. (CISA)

Apple Core Graphics zero-day joins CISA's exploited-vulnerability list

CISA added CVE-2026-86950, an Apple Core Graphics out-of-bounds write flaw affecting iOS, iPadOS, and macOS, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The bug is a frequent attack vector type that CISA says poses significant risk to federal networks. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-exposed assets that grant full control after exploitation, and CISA encourages all organizations to adopt the same risk-based approach to patching this vulnerability quickly. (CISA)

Astrana Health files 8-K over social engineering breach

Astrana Health, a managed services organization supporting value-based healthcare providers, filed an 8-K disclosing that its Astrana Health Management subsidiary suffered a social engineering campaign. Threat actors impersonated company personnel and spoofed its main phone number to trick employees into granting system access. Astrana engaged a forensics firm, notified law enforcement, reset affected credentials, restricted remote access tools, and restored systems from clean backups. The company determined on September 22, 2026 that the incident was material, and believes patient, employee, provider, and confidential business data may have been accessed, though no group has claimed responsibility. (HIPAA Journal)

Hasbro confirms vishing behind spring network intrusion

Hasbro told Massachusetts regulators that the network intrusion it disclosed in an April 8-K began with vishing and social engineering rather than malware, according to a report published September 28. Hasbro first flagged unauthorized access on March 28, 2026, took systems offline, engaged outside cybersecurity specialists, and invoked business continuity plans to keep shipping products. The six-month gap between the original filing and the confirmation of the attack method highlights how long it can take companies to explain exactly how intruders gained entry, even after early containment steps are taken. (Tech Insider)

FBI job-application portals stay down after ShinyHunters claim

The FBI's online job-application portals, apply.fbijobs.gov and fbijobs.gov/special-agents, remained offline after the extortion group ShinyHunters claimed to have compromised them using an unconfirmed Oracle PeopleSoft zero-day. The group said it also breached FBI-managed servers on AWS GovCloud and stole personnel files covering current, former, and prospective employees, including data from platforms handling background checks, medical records, and investigative information. Mandiant separately detailed how ShinyHunters modified an earlier PeopleSoft exploit, first used in May and June, to bypass web application firewall rules and expand targeting into higher education, healthcare, and government sectors. (Help Net Security)

Lumen names Kim Keever as Chief Security Officer

Lumen Technologies named Kim Keever as Chief Security Officer to lead security strategy across its physical, digital, and operational assets as the telecom prepares its network for AI-driven demands. Keever previously served as Chief Information Security Officer at Cox Communications and sits on the National Security Telecommunications Advisory Committee, which advises the U.S. government on communications resilience. Lumen said her mandate spans traditional cybersecurity along with broader protection of facilities, networks, and operational technology, and ties into the company's push for automated network security backed by its Black Lotus Labs threat research unit. (Pulse 2.0)